diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index aab3ab96da..5d61f0ad1f 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -3825,6 +3825,10 @@ static char *qemuDomainGetXMLDesc(virDomainPtr dom,
     unsigned long balloon;
     int err;
 
+    virCheckFlags(VIR_DOMAIN_XML_SECURE |
+                  VIR_DOMAIN_XML_INACTIVE |
+                  VIR_DOMAIN_XML_UPDATE_CPU, NULL);
+
     qemuDriverLock(driver);
     vm = virDomainFindByUUID(&driver->domains, dom->uuid);